Flashing and hacking the android phone for Japanese Softbank network.

So, i went to Google Developer Day 2009 last tuesday and got free HTCMagic GDD2009 phone – limited edition.
It’s very cool toy, has everything i need, but as usual here, MMS/Mail does not work when using normal cellphone SIM card.

The Story:

Here, in Japan, people use E-mails to communicate (more popular than SMS), but these are not ‘real’ emails – these are MMS’s converted to emails on the fly by provider.
So, by sending email to addres xx@softbank.ne.jp, their server will find who is recipient and convert it to MMS, sending to this person.
Vice-versa, by sending email from phone, it actually is MMS that you send, and provider will convert it to e-mail outside the network.

The way MMS receiving works: special SMS comes to the phone, it contains first 1024 bytes of message and some data instructing it to download the rest – this remaining part is being downloaded via standard HTTP protocol, but this is when problem starts – Softbank blocks HTTP User-Agent of unknown phones (not being sold by them).

Another (and the most annoying) problem i encountered, is the android device itself, the edition i have, does not support sending MMS at all.

Solutions:

Step 1:

Make backup of your current device (you can skip it if you’re too lazy or confident ;-) ):

Then, once you have the file on SD card, reboot your android, and while it starts keep “BACK” and “POWER” pressed – android will enter fastboot mode, then type:

fastboot boot recovery-new.img

Your android will run this recovery image which allows you few things, like update from sdcard, make backup etc.

Choose the option to backup nandroid.
It will place backup of your current device onto the SD card – might be worth keeping :-).

YOU DO NOT need to ‘root the magic’ or do any other steps from this instructions – these steps are for other purposes, not applicable here.

—

Step 2:

Making android support MMS (if your provider does not block user agent this is the only and final step):

This will flash your device to the same version as Google IO event, you get few features like Voice synthesis (voice search and voice dial), Amazon MP3 access – these are not present in Japanese version.
But, the drawback is – You will not have Japanese language support anymore.

First, make sure you really need to enable MMS, go to Messaging application, start typing, and press menu, if you DO NOT have options lile ‘add subject’, ‘attach’ – then you DO need it.

You DO NOT need worry that instructions is for Google IO edition and not GDDC09 – these phones are in fact different but there are ways around it.

I recommend using fastboot method (its not at all hard),

You will need to downlaod fastboot binary (available at HTC), and 2 of these images: Radio Image and System Image.

Follow instructions for Radio Image installation, most likely your device will boot after it completes but you will get permanent android starting logo,
please have your USB cable connected and adb showing logging – you will see that it tries to boot all over again – THIS IS OK – no need to panic.

Place radio image onto your card by typing:

adb push <radio-image-package>.zip /sdcard/update.zip
adb shell sync

Boot into recovery mode by holding HOME while it reboots, Then choose ALT+s on the screen, next HOME+BACK, device should reboot, it might not start at this point by just showing you android logo – this is ok, no need to panic…

Once you have radio package downloaded and flashed , time to flash it with system image – this is little tricky:

Push the image onto SD card:adb push <system-image-package>.zip /sdcard/update.zip
adb shell syncBoot into Fastboot (BACK+POWER while you start it) – MAKE NOTE OF ‘hboot’ version – you will need it very shortly.

You can safely try to flash system image, but it will fail due to incompatible HBOOT version (they require 1.33.3004, and you have probably 1.33.3005).
No need to worry here, we can make it happen :-).

So, what you need to do, is to UNPACK your system image to a folder, edit the file android-info.txt, change the require version-bootloader to your hboot version (1.33.3005 most likely), save it, and compress all the files in this directory into new zip file (all of them need to be in the ‘root’ of zipfile).

So, now you have compatible system image that will work well on your device, try flashing it now, DO NOT FORGET to select options to clean userdata and cache – this is required, without it, your device will boot only to android logo and keep hanging there.

—

Step 3:

Modifying User-Agent string in the MMS client (this *MAY* be enough to complete only this step and it might as well make your device support MMS’s – i have done all steps though):
(GGDC09 version has MMS disabled, and i am not sure whether just changing MMS app is enough to enable this).

Further work: change more of android source, to have nice settings under MMS app, to edit UserAgent :-D.

Enjoy :-)

——-

UPDATE!!!

Thanks to Roberto Jung Drebes , now i know that there’s no need to flash GGDC09 with anything to get MMS working, all it takes is to use my MMS.app (or compile your own) – just the way i suspected.

Also, he found that setting apn type as ‘mms’ – doesn’t work unless you already have other apn with type ‘default’ – this way it works very well. Good way to ensure you don’t end up with huge phone bill due to data transfer…

84 thoughts on “Flashing and hacking the android phone for Japanese Softbank network.”

Comment navigation

Hello,
Thank you very much for this tutorial,
and thank you for your mail,
Maybe you should post the APN for mms settings and explanations?
I have browsed a lot of websites where the same question is asked but no answer was found.

Especially the explanation about “default” and “mms” APN TYPE where most usefull :-)

I will not post settings for softbank here, whoever wants them knows how to contact me…

Softbank changes apn passwords quite often, mainly because of people posting them publicly…
I don’t agree with them at all, what’s wrong with giving people plain settings – we pay for it, but that’s their policy and we can’t help much…

As I wrote in privately, I managed to get MMS working just by installing your patched MMS app. Thank you. :)

The advantage of not having to flash the firmware is that you keep the Japanese IME, so you can still write Japanese messages etc. I’ll probably try flashing the firmware later on when some more features are available.

And just for the record, the “mms” APN type only works if you already have another APN set as “default”. If you only have one APN you should let the type empty (or as “default”).

Connect phone to PC via USB cable, launch adb with verbose logcat. Watch the log, send mail to your cellphone.
You should see a bunch of hex characters when it comes – this is the push raw sms – if this comes, and nothing shows up on the phone itself – this means your phone doesn’t recognize push message – it happened to me on original GDDC09 build without any hacks.
After i flashed mine with IO09 version, at the time of receiving sms it did show the notification (along with sender/subject), with download button – but this wouldn’t work without hacking (under logcat you can see Access Denied error when mms client connects via http to softbank) – this is when you need my patched Mms.apk to fake useragent (it pretends to be some Nokia phone).
Try this and it should work.
Also, start small, set just one apn, with exactly the settings i gave you (mms proxy is proxy, not mms server of course) and try again. It works!

*** If you ever get bored, take the hex sms message form logcat and paste it into any hex->ascii decoder – you WILL see how message looks, it has sender, subject, first xx chars of the email and url instructing phone how to retrieve the rest :-).

Hmm, i think i get your point, it seems that exactly the same settings work well on my regular cellphone card, but not on new iphone 3G’s card (card registers well, can make calls, but no data connection)…

Hi,
Yes I think there is a different settings for :
-regular phones
-iphone(black sims)
-windows mobile (silvers sims)
I have checked several forums, where they say the APN is different at least for iphone/wm
hope you find a solution,
I will report if I find something elsewhere :-)

Hi, and what card do you have ?
(i have 1 yr old standard cellphone card – silver -apn opensoftbank.* works, and iphone 3gs card – black – apn smile.* works).
I have sent you the smile.* via email yesterday – does it still not work ?

And yes, it’s possible wm phones have even different apn (is your card from wm? )

NAME->set,
APN->set,
Proxy->not set,
proxy port->not set,
username->set,
password->set,
server->not set
MMSC->set
MMS Proxy->set,
MMS port->set,
MCC-> set to default 440
MNC-> set to default 20
APN TYPE->not set //if you have another apn for the internet with type default, this one should have type mms.

Now, when you do this, connect phone to pc, launch adb
(adb logcat -v long ), send mail to yourself (have auto-download ON) and wait for adb logging, first you should see few lines of hex digits – this is push sms coming (you can decode it), and then you should see mms retrieval session, if indeed UA is forbidden you should see access denied errors – try that on fresh Mms.apk with default “Android” UA, and on the one provided by me (“Softbank 705NK***”).
You can try applying my patch with this UA “SoftBank/1.0/X01T/SCJ001”, then compile and install this Mms.apk on your own. (i still have the source so can do this)- but only try this if 2 previous methods do give you access denied..
If you still get access denied on all three methods then indeed there may be even different UA for your card, if not – this means some other problem…

It’s pretty self-explanatory, using first you can patch your own source to add user-agent changer into Mms.apk settings,
the second one is Mms.apk itself (rename before installing). The patched app has default User-Agent the same as original one in source (Android-Mms/0.1),

By changing it yourself to “SoftBank/1.0/705NK/NKJ002/SN001 Android-Mms/0.1 Profile/MIDP-2” – you achieve the same functionality as installing previous Mms.apk from my site.

To verify, you can run “adb logcat V”, while sending/receiving MMS, it will print UA string, examples:

#1) will fastboot work on any handset or only developer versions. The HTC docs mention specific bootloaders.

Based on your comment “change the require version-bootloader to your hboot version” I think it should work on retail handsets too. Is that right?

#2) What do you think about Hero? I don’t have a handset yet but will need to go the Softbank prepaid SIM-card route and get mail working. Then I’ll need to root it to get a Japanese IME on board. Should I just stick with a Magic handset and follow your instructions here or do you think there will be something for Hero on the xda-developers.com site. The android section on Hero in empty though I see ports of Hero for the Magic handset under Sapphire.

There must be some way to flash firmware even on retail ones, but i’m not sure about fastboot.
Magic supports “standard” firmware update mode (where it displays some icon on the screen), so it’s really hard to say what will happen on retail handsets.
I guess there’s no better way than walk to Docomo store after July 10th and trying it yourself (i will try to do that :-D ).

Changing required bootloader version happens IN THE zipped firmware file, so it has nothing to do with handset being retail or not.
Of course being able to flash it onto the handset depends on fastboot etc.

2.
Not sure about hero, haven’t seen it.
Though, Magic and G1 are exactly the same thing (other than missing keyboard etc).
Looking at specs, Hero as well has the same cpu, it only has better cam, and mpeg decoder.

So i guess you could just flash it with whatever is there for magic.
To get IME, you can flash it with non-retail dev GDDC09 images – on my site.

Hi, in very short, i don’t think it’s a problem to root/reflash 1.33.3005 – using any other images available, you can edit required hboot version by unzipping/rezipping image files ;-) – and fastboot will not complain even a bit…

I think it has to do with the fact that this is a stock Hero ROM – on a phone purchased in the UK.

As you didnt sign the mms.apk with the same cert that the original was signed with it’s impossible to overwrite it. adb uninstall didn’t work and so I’m going to have to try to rm within the shell and then push your .apk (or alternatively an mms.apk that I found on xda – http://forum.xda-developers.com/showthread.php?p=4234709 )

That is interesting, if i remember, installing my Mms.apk caused original one to be removed from system apps and new one installed under use apps.
But i’m not sure whether adb is trying to remove old app or install new one in it’s place.
What OS are you running ?

So Kuba what do I need to do to make similar MMS UA-string modications to my Hero Mms.apk? I suppose this is going to require decompiling, adding the appropriate hard-coded MMS UA-string and then recomping the .apk?

Hmm, im not sure actually, os version looks the same as mine, never played with Hero.
It’s interesting why my app doesn’t get installed, maybe your operator did something with certificates so that it requires apps to be signed appropriately…
Do you mind sharing your rom backup so that i can try it in emulator ?

Thank you Kuba for your script. I’m currently trying to use a prepaid SIM card from a Softbank 730SC Phone. I’m using a User Agent String of the format listed above SoftBank/1.0/###@@/@@001 and settings that enable sending of MMS, but prevent me from receiving or downloading messages. Has anyone else experienced this issue or can comment on it?

kei_ef_2000, I haven’t really played with Hero yet, could you rip off your Hero rom and give it to me somehow so that i can try it out myself ?
If i can access Hero rom, then maybe i can hack Mms.apk somehow. Otherwise the only access i have is official source code on google.
Thanks.